CVE-2026-42486: CWE-250 Execution with unnecessary privileges in Xen XAPI
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles The pool-admin role is fully privileged. Notably, users with this role can also SSH into the host as root. The other administrator roles are pool-operator, vm-power-admin and vm-admin, each of which are authorised to configure and manage various aspects of the system. Some settings are inadequately restricted, and can be set by a lower privilege of administrator than expected. * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and turn arbitrary files in dom0 into VDIs (virtual disks) and give said disks to a VM they control. This is an arbitrary read and/or modify of files in dom0. * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain and mark a VM as a system domain. System domains are ignored and left running during certain other host/pool operations, and may be hidden from view in tooling. * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain and mark a VM as the storage domain for a particular host storage connection (PBD). Shutting down the VM can cause the PBD to be erroneously marked as unplugged when it is not. * CVE-2026-23562: Configuration of PCI passthrough is normally restricted to the pool-admin role. However one API was missing this check, allowing a vm-admin access to unintended host hardware. * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role, as it can allow arbitrary dom0 file write.
AI Analysis
Technical Summary
XAPI uses Role Based Access Control to assign different privileges to users. The pool-admin role is fully privileged, including root SSH access to the host. Other administrator roles such as vm-admin have restricted permissions. However, CVE-2026-42486 identifies that a vm-admin can set the VM.platform:hvm_serial parameter, which should be limited to pool-admin only. This improper restriction allows vm-admin users to write arbitrary files in dom0, violating the principle of least privilege and potentially compromising the host system. This vulnerability is one of several related privilege escalation issues in XAPI where lower privileged roles can perform unauthorized actions.
Potential Impact
An attacker with vm-admin privileges can write arbitrary files in dom0 by setting the VM.platform:hvm_serial parameter. This can lead to unauthorized modification of the host system, potentially allowing code execution or disruption of host operations. The vulnerability undermines the intended role-based access controls, increasing the risk of privilege escalation and host compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict vm-admin role assignments to trusted users only and monitor for suspicious activity involving VM.platform:hvm_serial parameter changes. Review and tighten role-based access controls to ensure that only pool-admin users have permissions to modify sensitive VM parameters.
CVE-2026-42486: CWE-250 Execution with unnecessary privileges in Xen XAPI
Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] XAPI can configure different users with different roles, using Role Based Access Control. For more details, see: https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles The pool-admin role is fully privileged. Notably, users with this role can also SSH into the host as root. The other administrator roles are pool-operator, vm-power-admin and vm-admin, each of which are authorised to configure and manage various aspects of the system. Some settings are inadequately restricted, and can be set by a lower privilege of administrator than expected. * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and turn arbitrary files in dom0 into VDIs (virtual disks) and give said disks to a VM they control. This is an arbitrary read and/or modify of files in dom0. * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain and mark a VM as a system domain. System domains are ignored and left running during certain other host/pool operations, and may be hidden from view in tooling. * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain and mark a VM as the storage domain for a particular host storage connection (PBD). Shutting down the VM can cause the PBD to be erroneously marked as unplugged when it is not. * CVE-2026-23562: Configuration of PCI passthrough is normally restricted to the pool-admin role. However one API was missing this check, allowing a vm-admin access to unintended host hardware. * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial parameter, which should be restricted to the pool-admin role, as it can allow arbitrary dom0 file write.
CVSS v4.0
Score 9.4critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
XAPI uses Role Based Access Control to assign different privileges to users. The pool-admin role is fully privileged, including root SSH access to the host. Other administrator roles such as vm-admin have restricted permissions. However, CVE-2026-42486 identifies that a vm-admin can set the VM.platform:hvm_serial parameter, which should be limited to pool-admin only. This improper restriction allows vm-admin users to write arbitrary files in dom0, violating the principle of least privilege and potentially compromising the host system. This vulnerability is one of several related privilege escalation issues in XAPI where lower privileged roles can perform unauthorized actions.
Potential Impact
An attacker with vm-admin privileges can write arbitrary files in dom0 by setting the VM.platform:hvm_serial parameter. This can lead to unauthorized modification of the host system, potentially allowing code execution or disruption of host operations. The vulnerability undermines the intended role-based access controls, increasing the risk of privilege escalation and host compromise.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict vm-admin role assignments to trusted users only and monitor for suspicious activity involving VM.platform:hvm_serial parameter changes. Review and tighten role-based access controls to ensure that only pool-admin users have permissions to modify sensitive VM parameters.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- XEN
- Date Reserved
- 2026-04-27T14:20:24.138Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4fbf4868715ace439fdd98
Added to database: 07/09/2026, 15:33:28 UTC
Last enriched: 07/09/2026, 15:47:50 UTC
Last updated: 07/09/2026, 16:33:17 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.